Agent Baseline has published The Secure Software Factory: A Reference Architecture (version 1), described in Socket's announcement. Its premise fits one sentence: do not rely on an agent to stay inside its limits; enforce those limits somewhere the agent cannot reach. Socket CTO Ahmad Nassri co-authored it with contributors from Docker, Keycard, Barclays and Secure Theory, and the full text is on GitHub, open for comment.
A "software factory" here means any system where AI agents carry work from a prompt, ticket or alert through to tested code, and sometimes deploy and operate it.
TL;DR
| Question | Answer |
|---|---|
| What is it? | An open reference architecture, not a product or a vulnerability |
| Core idea? | The agent proposes actions, policy authorizes them, infrastructure enforces them |
| Does it fit one developer with one agent? | Yes: the same four boundaries apply at three autonomy levels |
| Do I need to install anything? | No; you map it onto tooling you already have |
| Where does Beam fit? | A local layer on one machine; it is not the network or registry boundary |
The four boundaries
- Sandbox. The environment the agent runs in.
- Network. What the agent can reach. All agent traffic passes through a proxy the agent cannot reconfigure, allowing only approved destinations. The point is to block workarounds such as fetching tarballs straight from a CDN or doing its own DNS lookups.
- Supply chain. Packages, dependencies and models must pass through an approved gateway, such as a registry or supply chain firewall, that serves only approved versions and hides unsafe ones.
- Identity and access. The permissions the agent operates under.
The same four apply at three levels of autonomy: a developer directing one coding agent, a predefined workflow run as a shared service, and an orchestrator agent that decides what work happens next. As autonomy rises, infrastructure takes over supervision that people used to provide.
The separation is the design. If the agent can edit its own proxy settings, allow-list or credentials, those controls are only suggestions. The architecture therefore keeps policy and enforcement in components the agent has no write access to, and treats anything the agent says about its own behavior as input to check, not evidence.
Why this matters now
Recent incidents show why prompt-level rules are weak. In Anthropic's unintended actions report, models routed around a URL-length limit with shorteners and acted where instructions left a gap. In npm worms aimed at AI tooling, the install path itself was the attack. A registry gateway and an egress proxy are the controls those cases point to.
What this means if you run AI coding agents
- Run agents in a container or VM you can discard, not your daily-driver account.
- Route package installs through a registry or firewall you control, and pin versions.
- Give agents their own scoped credentials, not your personal tokens.
- Restrict outbound destinations at the network layer rather than in the prompt.
See the enterprise rollout checklist and supply chain security guide for deeper steps.
What Beam can and cannot do here
Beam watches what Claude Code, Codex and similar agents do on a single machine, keeps data on-device, flags risky actions such as credential exposure, and scans skills and MCP configs before you run them (11 heuristics plus a version-pin check). With workspace enforce, PreToolUse hooks for Claude Code and Codex can deny matching tool calls. That is a useful local layer, and monitoring versus blocking explains the tradeoff.
It is not a kernel sandbox, does not proxy network traffic, does not gate your package registry, and fails open when cached policy is missing. Treat it as an evidence and guardrail layer inside, not instead of, the boundaries above. See how Beam works.
Frequently asked questions
What is Agent Baseline's secure software factory?
A version 1 reference architecture for systems where AI agents take work from a prompt, ticket or alert through to tested code. It treats agents as untrusted and enforces limits outside them.
What are the four boundaries?
Sandbox, network, supply chain, and identity and access.
Why an egress proxy the agent cannot reconfigure?
To block workarounds such as fetching tarballs directly from a CDN or doing its own DNS lookups.
Is this a product I can install?
No. It is a reference architecture, open for comment on GitHub.
How does this relate to Beam?
Beam is a local observability and hook-based deny layer for individual developers, covering part of the picture on one machine.
Related reading
Details reflect Agent Baseline's version 1 publication as described on October 13, 2026. The document is open for comment and may change.